Mailinglist Archive: opensuse (4054 mails)

Re: [opensuse] undelete files that were deletet with "rm"?

From:
Rafa Grimán <rgriman@xxxxxxx>

Date:
Wed, 18 Jan 2006 09:57:07 +0100

Message-id:
<43CE02E3.5030703@xxxxxxx>

Hi :)

Cristian Rodriguez wrote:

Christian Lange wrote:

Hi
I just wanted to type "rm *~" to kill the backup files in my folder. Accidently, I slid of the key and mistyped the command. So it became "rm *" an all my data is los. Under MS-DOS there is a command called "undelete" which one can use to recover data. How is the command under Suse Linux 10.0?
Greetings, Chris

The only really efective tool..is called "backups".

If you haven't touched anything (no new files, no more deletions, ...)
you can get your info back with fornesic tools such as tct.

Another way (more elaborate) is:
1.- unplug your HDD (HDD_rm)
2.- plugit into another computer
3.- create an image of the deleted drive (HHD_rm)
onto the new drive (HDD_good)
4.- now you can deal with the image as if it were
a text file: you can use split, vi, grep, sort,
strings, wc, ... on it and search for text.